Topic starter
06/06/2026 1:36 am
TL;DR: CIBA gives AI agents a protocol for requesting human approval outside the browser session, so sensitive actions such as refunds, deletions, or infrastructure changes can pause and resume safely, according to WorkOS. The core issue is not UX but governance: approval must be bound to a specific action, not a standing permission model.
Editorial analysis by NHI Mgmt Group, based on content published by WorkOS: “How to add human approval to async AI agent actions”.
Key questions
Q: How should teams handle human approval for agent actions that happen outside a browser session?
A: Treat approval as a protocol-level authorisation event, not a UI prompt.
Q: Why is approval-bound to a specific agent action safer than broad consent?
A: Because broad consent assumes the future action is already known and acceptable, which is rarely true for sensitive operations.
Q: What are the signs that an agent approval flow is too weak?
A: If users are approving vague prompts, if the approval text does not match the actual operation, or if the same token can be reused across unrelated actions, the control is too weak.
Practitioner guidance
- Define approval-worthy agent actions Classify which tool calls require human sign-off before execution, using risk thresholds for destructive, financial, or externally visible actions.
- Bind approval to a specific transaction Write binding messages that name the exact action, object, and consequence so the approver can understand what is being authorised without context.
- Treat expiry as a control state Log expired requests with agent ID, user ID, action context, and requested expiry, then surface the outcome to the orchestrating system instead of retrying automatically.
Bottom line: CIBA turns human approval into a backchannel authorisation event, which is better suited to asynchronous AI agents than browser-based consent.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 2:50 am
Event-scoped approval is the real control boundary for asynchronous agents. Browser-based consent assumes the user and the request live in the same session. That assumption fails when an agent acts later, elsewhere, or on its own schedule. The practical result is that approval has to move from session consent to task-bound authorisation, where the decision is tied to one action and one identity context.
A few things that frame the scale:
- 40 percent of financial and software companies have already deployed agentic AI systems, and deployments are expected to double by 2028.
A question worth separating out:
Q: Should organisations separate agent permission checks from human approval checks?
A: Yes. Base permission checks decide whether the agent is allowed to attempt the action at all, while human approval decides whether a sensitive but permitted action should proceed. Mixing those layers creates false trust and makes it harder to explain why an action was allowed, denied, or expired.
👉 Read our full editorial: CIBA adds human approval to agent actions beyond the browser